Login Request a demo
Medium severity · published Nov 14, 2023
CVE-2021-46758
Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a…
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R3
Ryzen 3 4300u Firmware · Amd
before renoirpi-fp6_1.0.0.a · source: NVD
R3
Ryzen 3 5125c Firmware · Amd
before cezannepi-fp6_1.0.0.c · source: NVD
R3
Ryzen 3 5300g Firmware · Amd
before comboam4v2_pi_1.2.0.8 · source: NVD
R3
Ryzen 3 5300ge Firmware · Amd
before comboam4v2_pi_1.2.0.8 · source: NVD
R3
Ryzen 3 5300u Firmware · Amd
before cezannepi-fp6_1.0.0.c · source: NVD
R3
Ryzen 3 5400u Firmware · Amd
before cezannepi-fp6_1.0.0.c · source: NVD
R3
Ryzen 3 5425u Firmware · Amd
before cezannepi-fp6_1.0.0.c · source: NVD
R3
Ryzen 3 7335u Firmware · Amd
before rembrandtpi-fp7_1.0.0.5 · source: NVD
R5
Ryzen 5 4500u Firmware · Amd
before renoirpi-fp6_1.0.0.a · source: NVD
R5
Ryzen 5 4600h Firmware · Amd
before renoirpi-fp6_1.0.0.a · source: NVD
R5
Ryzen 5 4600hs Firmware · Amd
before renoirpi-fp6_1.0.0.a · source: NVD
R5
Ryzen 5 4600u Firmware · Amd
before renoirpi-fp6_1.0.0.a · source: NVD
Affected product
R3
Ryzen 3 4300u Firmware
Amd
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-46758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-46758
Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-4002
More from Ryzen 3 4300u Firmware
6.0
CVE-2023-20579
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections potentially resulting in loss of…